Provisioning API

1. Create a key

An organization owner or corporate admin can open Settings, choose API keys, set a name, choose the request limit, and create a key. The full key appears once. Store it in your carrier system as a secret.

Each key begins with ae_live_. Agent Elite hashes the bearer token with SHA-256 before it looks up the key. Send it on every request:

Authorization: Bearer ae_live_your_key

The available scopes are users:write for bulk member provisioning and scim for SCIM requests. New keys default to users:write. A key can carry both scopes.

2. Requests and rate limits

Set Content-Type: application/json for the bulk provisioning endpoint. Set Content-Type: application/scim+jsonfor SCIM requests.

A key has a token bucket with the per-minute limit chosen in Settings. The allowed range is 1 to 6,000 requests per minute. When the bucket is empty, the response is HTTP 429 with Retry-After: 60 on the bulk provisioning API. SCIM returns the same SCIM error shape with HTTP 429. The current SCIM response does not include a Retry-After header.

3. Bulk provisioning

Send one to 1,000 member records. Each record can include an email, name, role, supervisor email, division, and title. The valid roles areowner,regional_director,agency_director,general_agent,supervising_agent,agent, andindividual.

Use welcome_mode set toinvite_email ornone. The defaults are invite email, a wave size of 100, and a 60 minute interval. Setwave_size from 1 to 1,000 andwave_interval_minutes from 0 to 1,440.

curl -X POST https://www.agentelite.app/api/v1/users \
  -H "Authorization: Bearer ae_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "users": [
      {
        "email": "leader@example.com",
        "full_name": "Team Leader",
        "role": "supervising_agent"
      },
      {
        "email": "agent@example.com",
        "full_name": "New Agent",
        "role": "agent",
        "supervisor_email": "leader@example.com",
        "division": "North",
        "title": "Field Agent"
      }
    ],
    "welcome_mode": "invite_email",
    "wave_size": 100,
    "wave_interval_minutes": 60
  }'

The 202 response includes job_id,status, row counts, and up to 200 invalid row details.

4. Poll the import job

Poll the job endpoint with the same bearer key. The response includes the total, ready, invalid, created, skipped, and failed row counts, plus timestamps and any job error.

curl https://www.agentelite.app/api/v1/users/jobs/JOB_ID \
  -H "Authorization: Bearer ae_live_your_key"

A job ID from another organization or another API key returns HTTP 404.

5. Connect SCIM

Use the SCIM base URL below in your identity provider:

https://www.agentelite.app/scim/v2

In Okta, put this value in the SCIM connector Base URL and use the generatedae_live_ key as the bearer token. In Microsoft Entra ID, put this value in the Provisioning app Tenant URL and put the same key in the Secret Token field. Select the SCIM scope when you create the key.

The service supports Users and Groups, including list, create, read, replace, partial update, and deactivation or deletion routes described in the OpenAPI file. User filters support userName eq "value" andexternalId eq "value". Group filters supportdisplayName eq "value". List requests usestartIndex andcount; count defaults to 100 and caps at 200.

Enterprise user fields handled by the service are manager, division, and department. The enterprise extension URI isurn:ietf:params:scim:schemas:extension:enterprise:2.0:User. User data also carries title, active state, external ID, and group membership.

curl https://www.agentelite.app/scim/v2/Users?startIndex=1\&count=100 \
  -H "Authorization: Bearer ae_live_your_key" \
  -H "Accept: application/scim+json"

6. Outbound webhooks

Organization managers can configure an HTTPS endpoint in Settings, choose the events it receives, and copy the signing secret once. Agent Elite sendsrecording.completed,scorecard.generated,agent.onboarded, andwebhook.test.

Each request includesContent-Type: application/json,X-AgentElite-Event,X-AgentElite-Delivery,X-AgentElite-Timestamp,X-AgentElite-Signature, andUser-Agent: AgentElite-Webhooks/1. The signature has the form v1=hex and coverstimestamp.body with HMAC-SHA256.

The delivery body contains id,event,created_at,org_id, anddata. The data object includes the fields for its event. A recording event excludes transcript text and audio URLs.

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyWebhook(body, signature, timestamp, secret) {
  const received = Buffer.from(signature.replace(/^v1=/, ''), 'hex')
  const signedPayload = timestamp + '.' + body
  const expected = createHmac('sha256', secret)
    .update(signedPayload)
    .digest()
  return received.length === expected.length && timingSafeEqual(received, expected)
}

Return any 2xx status after processing. Agent Elite attempts delivery once and then retries five times at 1 minute, 5 minutes, 30 minutes, 2 hours, and 6 hours, six attempts in total. An endpoint is disabled after 20 consecutive failures.

Example test delivery:

{
  "id": "delivery-id",
  "event": "webhook.test",
  "created_at": "2026-01-01T12:00:00.000Z",
  "org_id": "organization-id",
  "data": {
    "message": "Test event from Agent Elite",
    "endpoint_id": "endpoint-id"
  }
}

7. Error format

Bulk provisioning errors use a JSON object with anerror string. SCIM errors useapplication/scim+json with the SCIM error schema, a string status, and a detail message.

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
  "status": "400",
  "detail": "userName is required."
}

8. Available integration paths

Agent Elite currently supports bulk user provisioning, import job polling, and SCIM 2.0 user and group provisioning, and SAML 2.0 single sign on set up with our team. Outbound webhooks deliver selected organization events to an HTTPS endpoint. There is no API for reading recordings or scorecards today. Ask us for the service provider values if your identity team wants to start.